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@ Apparatus and method for inhibiting analysis of a secure circuit 



@ A secure circuit (6) is protected from reverse 
engineering by sensing radiation (14) to which the 
circuit (6) is normally not exposed, but which is 
present in its analysis. The circuit (6) is modified in 
response to such radiation (14) so that it is not 
compromised by subsequent analysis. The secure 
circuit (6) can be implemented as a volatile memory 
having a power supply circuit V*. V~, (8) that is 
interrupted in response to radiation exposure. 
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BACKGROUND OF THE INVENTION 
Field of the Invention 

This invention relates to methods and appara- 
tus for protecting electrical circuitry from reverse 
engineering, and more particularly to the protection 
of codes stored in a nnemory circuit 

Description of the Related Art 

It is very important to prevent unauthorized 
access to certain portions of electrical circuits, par- 
ticularly integrated circuits. For example, digital 
codes or other data may be stored in certain por- 
tions of the circuit to prevent its unauthorized use; 
the circuit will function properly only if the user 
enters the appropriate code. Such circuitry may be 
compromised, however, by various methods of 
analysis, such as visual inspection, microprobing, 
x-ray, secondary electron emission voltage-contrast 
analysis, etc. A number of techniques have been 
used in the past to prevent such reverse engineer- 
ing. 

Perhaps the most basic technique is to enclose 
the circuit in a plastic encapsulation or protective 
die coating. However, access to the circuitry can 
still be gained by mechanical or acid drilling 
through the encapsulation material, or by sawing 
through the encapsulation. Another approach is to 
add misleading circuit topology so as to disguise 
the portion of the circuitry to be protected, or to 
customize each different die with its own specific 
code. An example of this approach is disclosed in 
U.S. Patent No. 4.766,516, "Method and Apparatus 
for Securing Integrated Circuits from Unauthorized 
Copying and Use." August 23. 1988, to Ozdemir et 
al. and assigned to Hughes Aircraft Company. 
These techniques may retard, but generally do not 
totally prevent, successful reverse engineering. 

SUMMARY OF THE INVENTION 

The present invention seeks to provide a pro- 
tection system and method that is more reliable 
than prior techniques for preventing the reverse 
engineering of secure circuitry, and which operates 
automatically if the circuit package is tampered 
with. 

The new protection technique provides a 
mechanism for modifying the secure circuit in case 
reverse engineering is attempted, so that the origi- 
nal circuit to which access is sought is no longer 
available. An actuating device for the modification 
function is provided that responds to radiation of 
the type used in a reverse engineering analysis, 
but to which the secure circuit is normally not 
exposed. When a reverse circuit analysis is at- 



tempted, the actuating mechanism senses the radi- 
ation and triggers the modification system to alter 
the secure circuitry. 

When the secured circuit is volatile and is 

5 maintained by a power supply circuit, the modifica- 
tion system can be used to interrupt the power 
supply circuit. The interruption may be accom- 
plished by means of a bipolar transistor switch, 
with a radiation responsive bias circuit for the 

10 switch. Other modification techniques include ap- 
plying an overcurrent to the secure circuit to de- 
stroy its functionality, or reprogramming a secure 
programmable memory. 

One actuating mechanism that can be used is 

76 an operational amplifier having a pair of differential 
inputs that are controlled by a radiation responsive 
element such as a photodiode. To reprogram a 
secure programmable memory circuit, the actuator 
may consist of a random access memory (RAM) 

20 cell formed from photosensitive transistors. The 
output from the RAM cell is connected to the 
secure memory's address line for reprogramming 
upon exposure to the radiation. Reprogramming 
can also be accomplished by an operational am- 

25 plifier with a radiation responsive input, and an 
output circuit connected to reprogram the secure 
memory. A multivibrator connected to the secure 
memory's address line through a radiation respon- 
sive switch is another reprogramming option. 

30 The protection system can be made respon- 

sive to virtually any type of radiation for which a 
sensitive element is available. This includes optical 
radiation (both visible and infrared), x-rays, and an 
electron beam (which may be considered as a form 

35 of radiation) from a scanning electron microscope. 

These and other features and advantages of 
the invention will be apparent to those skilled in the 
art from the following detailed description, taken 
together with the accompanying drawings, in which: 

40 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a perspective view of an encapsulated 
integrated circuit chip of the type that can be 

45 protected by the present invention; 

FIG. 2 is a circuit diagram of one embodiment in 
which the power supply for a secure volatile 
circuit is interrupted in response to radiation 
used in a reverse engineering attempt; 

50 FIG. 3 is a circuit diagram of a radiation respon- 
sive mechanism for reprogramming or burning 
out a volatile memory in response to sensed 
radiation; 

FIGS. 4a and 4b are circuit diagrams of al- 
55 ternate actuating mechanisms for the embodi- 
ments of FIGs. 2 and 3, respectively; 
FIG. 5 is a circuit diagram showing another 
radiation responsive mechanism for reprogram- 
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ming a volatile secure memory; and 

FIG. 6 is a block diagram of another scheme for 

reprogramming a secure memory circuit. 

DETAILED DESCRIPTION OF THE INVENTION 

It is generally necessary to expose a secure 
circuit to radiation in an attempt to reverse en- 
gineer the circuit. For example, integrated circuit 
(IC) chips are typically encapsulated In plastic or a 
metal "can", and are often mounted on a board 
within a sealed case. Access to the circuit must be 
gained to reverse engineer it. Such access is typi- 
cally obtained by sawing through the encapsula- 
tion, or using mechanical or acid drilling to access 
the chip's surface. Subsequent mechanical or 
scanning electron microscope (SEM) probing is 
then used to read out the secret code, in the case 
of a secure code stored in memory. X-ray analysis 
can also be performed In an attempt to determine 
the circuit's topography. Whatever technique Is 
used to expose the chip's surface, the circuitry will 
normally be exposed to optical or other radiation 
during or as a result of the process. 

A typical encapsulated IC is illustrated in FIG. 
1 . The chip is housed within a plastic/epoxy encap- 
sulation 2, with lead wires 4 extending out of the 
encapsulation from the chip's contact pads. 

A first embodiment of the invention is illus- 
trated in FIG. 2. A circuit 6 to be secured is 
included on a circuit chip that is encapsulated as 
shown in FIG. 1, or is otherwise protected from 
radiation normally used in a reverse engineering 
operation. The secure circuit 6 Is preferably Imple- 
mented as a programmable volatile digital memory, 
such as a static or dynamic RAM (random access 
memory). Dynamic RAM cells use a transistor and 
capacitor combination, with the digital information 
represented by a charge stored on each of the 
capacitors in the memory array. A static RAM. on 
the other hand, uses a series of transistors to form 
a flip-flop for each cell in the array. Both types of 
memory are considered to be "volatile" In the 
sense that they must be constantly maintained to 
retain their memory codes. The maintenance func- 
tion Is performed by a power supply circuit. If a 
dynamic RAM is not replenished from the power 
supply on a regular basis (typically every 2 ms), 
the capacitors will lose their charge and the code 
will be altered. If power is removed from a static 
memory.the flip-flop will reset and the memory will 
display a different code when power Is restored. 
The secure circuit 6 will generally be part of a 
larger overall circuit (not shown) fabricated on the 
chip. 

The RAM 6 is connected in a power supply 
circuit between positive and negative voltage bus- 
ses V+ and V-via a switch 8 that interrupts the 



power supply circuit when It is opened. Switch 8 
may be implemented as a bipolar transistor, as 
indicated in the drawing. 

The operation of transistor switch 8 is con- 

5 trolled by an actuator circuit that is connected to 
provide a control signal to the transistor base. The 
actuator circuit is preferably implemented by an 
operational amplifier 10 that is connected to the 
power supply lines so as to provide a normally 

10 "on" signal to the base of switch transistor 8. A 
radiation sensitive switch, such as a PIN 
photodiode 12, is connected between the ampli- 
fier's Inverting and non-inverting input terminals. 
The photodiode 12 Is preferably fabricated on the 

IS chip in relatively close proximity to the RAM 6. 
When the chip is exposed to radiation 14 in the 
course of a reverse engineering attempt, such as 
by opening the chip encapsulation so that optical 
radiation strike the chip's surface, the photodiode 

20 12 Injects electrons into the operational amplifier's 
non-inverting Input. This drives the amplifier's non- 
inverting input to a negative level relative to its 
inverting input, causing the amplifier's output to 
similarly be negative or at most zero. As a result, 

26 the gating signal is removed from switch transistor 
8 and the transistor effectively produces an open 
circuit between the power supply port P of RAM 6 
and the positive voltage line V + , thus interrupting 
the power supply maintenance circuit for the RAM. 

30 The volatile RAM circuit accordingly loses the se- 
cure code with which it was originally programmed, 
so that the reverse engineering attempt will yield 
the wrong code. 

At alt other times, the diode 12 is shaded from 

35 the optical radiation by the chip encapsulation, and 
thus functions in a normal diode function to assure 
that the voltage at the operational amplifier's invert- 
ing input does not appreciably exceed its non- 
inverting input voltage. The bias applied to the 

40 power supply circuitry causes the amplifier to pro- 
duce a positive output that holds transistor switch 8 
closed, thus maintains the power supply for RAM 
6. 

FIG. 3 shows another embodiment of the In- 
45 ventlon. This approach also uses a programmable 
memory such as RAM 6, and an operational am- 
plifier 10 with a photodiode 12 connected in its 
input circuit. In this case, however, the power sup- 
ply is biased so that operational amplifier 10 is 
50 normally off. The output of amplifier 10 Is con- 
nected through a number of diodes 16a, 16b, 16c 
to respective address terminals of RAM 6. When 
the chip's surface Is exposed to radiation 14. diode 
12 injects electrons Into the operational amplifier's 
55 inverting input, driving it negative relative to the 
non-inverting input. A positive output is thus pro- 
duced from the operational amplifier 10 that resets 
the RAM, erasing the secure code. If the amplifier 
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10 is a high power device, this arrangement can be 
used to overheat and burn out the memory (which 
in this case can alternately be a read only nnem- 
ory), thus destroying the nnemory circuit's ability to 
hold any secure code. 

The circuits of FIGs. 2 and 3 require that the 
power supply be biased properly to set the oper- 
ational amplifier either normally "on" or normally 
"off", respectively. However, this bias is subject to 
voltage spikes on the power supply line that can 
erase the memory. Either a very good filter should 
be used for the power supply line, or an alternate 
actuating mechanism that is not so vulnerable to 
power supply voltage spikes should be substituted. 

Examples of suitable alternate actuating circuits 
are given in FIGs. 4a and 4b, which are used to 
hold the operational amplifier 10 normally "on" and 
normally "off", respectively. In FIG. 4a, the non- 
inverting input to the operational amplifier is tapped 
from a voltage divider circuit consisting of resistors 
R1 and R2 connected in series between V+ and 
V-. The resistor values are selected so that the 
non-inverting amplifier input is held at a voltage 
just slightly greater than zero (for example, on the 
order of + 0.01 volt). The photodiode 12 is con- 
nected to normally keep the amplifier's inverting 
input from rising above ground potential, so that 
the amplified output to transistor switch 8 is posi- 
tive and normally holds the switch closed. 

When photodiode 12 is exposed to light, it 
draws electrons from the amplifier's inverting input, 
sending the inverting input positive. This causes 
the amplifier's output to go negative, turning off the 
transistor switch 8. 

This arrangement is reversed in FIG. 4b, in 
which the voltage divider circuit R1-R2 holds the 
amplifier's inverting input slightly positive, and the 
non-inverting input is normally held at ground po- 
tential or less by photodiode 12. When exposed to 
light, photodiode 12 sends the amplifier's non-in- 
verting input positive, causing the amplifier output 
to go positive and either reprogram or burn out 
RAM 6. 

Another approach to reprogram mi ng a secure 
memory circuit in response to radiation exposure is 
shown in FIG. 5. In this circuit a radiation sensitive 
RAM cell 18 is used to reprogram RAM 6. Cell 18 
can either be separate from, or integrated into, 
RAM 6. Its circuit design is conventional, utilizing 
CMOS (complementary metal oxide semiconduc- 
tor) devices. It consists of two branches, with each 
branch having series connected n-channel and p- 
channel transistors, and the gates and drains of the 
p-channel devices in the two branches cross-coup- 
led. Output lines 20 and 22 are taken from the 
electrical mid-points of the two branches, and con- 
nected to respective address ports of RAM 6. 

Transistors such as those used in RAM cell 18 



are inherently optically sensitive. When the cell is 
exposed to optical radiation, the outputs to RAM 6 
will change in a random, unpredictable fashion to 
reset-reprogram RAM 6. The output pattern sup- 
5 plied by the cell 18 will depend upon which of its 
transistors is illuminated first, and the states of the 
various transistors immediately prior to illumination. 
Alternately, one of the cell transistors could be 
made larger than the others so that it is more light 
10 sensitive, and accordingly always changes state 
when illuminated. An initializing line 24 is prefer- 
ably connected to one of the p-channel transistors 
in the cell 18 so that the normal transistor states 
without illumination can be controlled. 
15 Another variation that reprograms the RAM 6 in 

response to radiation exposure is illustrated in FIG. 
6. The output of a multivibrator 26 is connected to 
one or more of the RAM address lines through the 
source-drain circuit of a field effect transistor (FET) 
20 28; the FET's gate is allowed to float. FETs have a 
fairly high optical sensitivity, so that FET 28 be- 
comes conductive when the chip package is 
opened and its interior exposed to light. This allows 
the multivibrator output to be connected directly to 
25 the address lines of RAM 6, causing the RAM to be 
continuously cycled for as long as FET 28 Is Illumi- 
nated. The secure code will thus be unavailable for 
reverse engineering. 

While the invention has been illustrated with 
30 circuitry that is sensitive to optical radiation, it can 
also be implemented with circuit devices that are 
sensitive to x-rays or any other portion of the 
electromagnetic spectrum that might be utilized in 
a reverse analysis, limited only by the availability of 
35 devices that are sensitive to radiation at any par- 
ticular wavelength. An electron beam from a scan- 
ning electron microscope may also be considered 
to be a form of radiation for this purpose. While 
scanning electron microscopes operate at a fairly 
40 low energy level and their beams are difficult to 
detect, suitable sensitive circuit devices may be- 
come available that can be used to disable a 
secure portion of the circuit in response to a scan- 
ning electron beam, in a manner analogous to the 
45 photodiodes or FETs described herein. 

While particular embodiments of the Invention 
have been shown and described, numerous vari- 
ations and alternate embodiments will occur to 
those skilled in the art. Accordingly, it is intended 
50 that the invention be limited only in terms of the 
appended claims. 

Claims 

55 1. A protection system for inhibiting analysis of a 
secure circuit (6), characterized by: 

- means (8; 16; 18: 20, 22; 26) for modify- 
ing said secure circuit (6) to inhibit its 



4 



EP 0 510 434 A2 



4. 



successful analysis; and 
- an actuation means (10. 12; 18: 28) for 
said modifying means (8; 16; 18; 20, 22; 
26). said actuation means (10. 12; 18; 28) 
being responsive to radiation (14) that is 5 
present in said analysis, but to which the 
secure circuit (6) is normally not ex- 
posed, to actuate said modifying means 
(8; 16; 18; 20. 22; 26) to modify the 
secure circuit (6). io 

The protection system of claim 1, character- 
ized by said secure circuit (6) comprising a 
volatile circuit that is maintained by a power 
supply circuit (8, V*. V~), said modifying 75 
means (8) comprising means for interrupting 
said power supply circuit (8, V*.^). 

The protection system of claim 2, character- 
ized by said modifying means (8) comprising 20 
an interrupt switch in said power supply circuit 
(8. V*. V~), said actuation means (10, 12) 
comprising an actuator (10) for said switch, 
said switch comprising a bipolar transistor (8), 
and said actuation means (10, 12) comprising 25 
a bias circuit for said transistor (8) that re- 
sponds to said radiation (14) by altering the 
switching state of said transistor (8). 

The protection system of any of claims 1 30 
through 3. characterized by said actuation 
means (10, 12) comprising an operational am- 
plifier (10) having an output connected to con- 
trol said modifying means (8), and a pair of 
differential inputs that are coupled by an ele- 36 
ment (12) that is responsive to said radiation 
(14). 



state, and a pair of differential Inputs, and said 
actuation means comprises a radiation respon- 
sive element (12) connected to alter the oper- 
ational amplifier's switching state when said 
element (12) is exposed to said radiation (14). 

8. The protection system of claim 8, character- 
ized by said actuation means comprising a 
random access memory (RAM) cell 18 formed 
from a plurality of photosensitive transistors P, 
N. and said modifying means (20, 22) compris- 
ing circuit means connecting the output of said 
RAM cell 18 to the programmable memory's 
address line. 

9. The protection system of claim 6, character- 
ized by said modifying means comprising a 
multivibrator (26), and said actuation means 
comprising an interrupt switch (28) normally 
disconnecting the multivibrator's output from 
said program address line, said interrupt 
switch (28) responding to exposure to said 
radiation (14) to apply the multivibrator's output 
to said program address line so that said prog- 
rammable memory (6) is cycled by said mul- 
tivibrator (26) during said exposure. 

10. A method of protecting a secure circuit (6) 
from being analyzed, characterized by : 

- sensing radiation (14) to which the circuit 
(6) is normally not exposed but which is 
present in said analysis: and 

- modifying the circuit (6) in response to 
its being exposed to said radiation (14) 
so that its analysis after such modifica- 
tion will not compromise the circuit (6). 



5. The protection system of claim 1. character- 
ized by said secure circuit (6) comprising a 
programmable memory programmed with a 
predetermined code, and said modifying 
means (10, 16; 18; 26) comprising means to 
reprogram said memory. 

6. The protection system of claim 5, character- 
ized by said programmable memory (6) having 
a program address line, said modifying means 
(10, 16; 18; 26) comprising circuit means for 
applying a reprogram signal to said address 
line. 



45 



so 



The protection system of claim 6, character- 
ized in that said modifying means comprises 
an operational amplifier (10) having an output 
connected to apply said reprogram signal to 
said address line when the operational am- 
plifier (10) is in a predetermined switching 
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FIG. 4a. FIG. 4b. 
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FIG. 6. 



MULTI- 
VIBRATOR 



J L 



28 



f6 



RAM 



